# Data governance

This document defines **retention, deletion, and recovery expectations** for tenant data, audit artifacts, exports, and integration telemetry. It must stay aligned with operational reality (disk, DB cost, legal requests).

---

## Principles

1. **Purpose limitation** — retain data only as long as needed for **operations**, **audit**, or **legal** obligations.
2. **Tenant boundary** — deletion and retention jobs are **tenant-scoped** unless explicitly global (e.g. system logs).
3. **Recoverability** — backups and exports are part of the **RPO/RTO** story; document what is **not** recoverable.

---

## Retention policies (defaults to be made concrete per deployment)

| Class | Examples | Default posture |
|--------|-----------|-------------------|
| **Operational data** | HR records, attendance, payroll inputs | Retained per **contract** and **legal** requirements; no anonymous mass deletion without workflow. |
| **Activity / audit logs** | Admin activity, API audit | Hot retention + optional archive; see `compliance-readiness.md`. |
| **Exports** | CSV/ZIP exports | Short **hot** window on application storage; longer only if moved to **durable archive** with access controls. |
| **Integration telemetry** | Webhook deliveries, security events | Bounded retention for **debugging** vs **security**; separate hot vs cold. |
| **Queue failed jobs** | `failed_jobs` | Bounded; investigate before purge. |

Exact durations are **environment-specific** — they must be recorded in internal ops config / runbooks, not only in code defaults.

---

## Audit retention

- Audit trails that support **payroll disputes** and **access investigations** generally require **longer** retention than web request logs.
- **Immutable** integration events follow `event-contracts.md`; retention of **delivery rows** may be shorter than **event** rows.

---

## Export retention

- Exports often contain **PII** — treat as **sensitive artifacts**.
- Auto-delete exports after **N days** unless user pinned / downloaded to client responsibility.
- Link downloads to **authorized** users and **audit** the access.

---

## Deletion policies

- **Soft delete** vs **hard delete** must be explicit per entity (HR vs admin objects).
- **Cascade rules** must not accidentally remove **financial evidence** without an approved workflow.
- **GDPR-style** workflows (see `compliance-readiness.md`) require **verification**, **logging**, and **propagation** to backups/archives.

---

## Recovery expectations

- **RPO/RTO** are business-owned numbers; engineering implements **backup frequency**, **restore drills**, and **runbooks**.
- After restore, validate **tenant isolation** and **job idempotency** before reopening traffic.

---

## References

- `docs/governance/compliance-readiness.md`
- `docs/governance/incident-response.md`
- `docs/governance/schema-evolution.md`